Cyber Essentials got stricter in April 2026. Every assessment started since 27 April uses version 3.3 of the requirements and IASME’s new “Danzell” question set. The three changes that matter most: multi-factor authentication (MFA) is now compulsory on every cloud service that offers it, cloud services can no longer be left out of scope, and missing a critical security update for more than 14 days is now an automatic fail. Passkeys are also recognised for the first time. Here’s what that means in practice, and the things that most often trip businesses up.
If you want to know what certification costs, we’ve covered that separately in how much Cyber Essentials costs in 2026. This article is about passing.
What changed in April 2026
- MFA on every cloud service, no exceptions. The requirements now say authentication to cloud services “must always use MFA”. IASME has confirmed that if MFA is available and you haven’t switched it on, whether it’s free, included or a paid option, the whole assessment fails.
- Cloud services are always in scope. The scheme now defines a cloud service: an online service, reached through an account (either one your business issued or a work email address), that stores or processes your organisation’s data. If your data is in it, it’s in scope, and it can’t be excluded.
- Two automatic-fail questions on updates. One covers operating systems and router or firewall firmware, the other covers applications and their extensions. Both require high-risk or critical updates to be installed within 14 days of release.
- Passkeys are recognised. The definition of passwordless sign-in now includes FIDO2 passkeys, and the requirements say FIDO2 authenticators count as MFA.
- Scope is more visible. Your scope description and every legal entity included in it can now be viewed on the digital certificate platform, so it’s worth describing your scope clearly and accurately.
- Directors sign up to the whole year. The board or director declaration now acknowledges responsibility for keeping every control in place throughout the certification period, not just on assessment day.
- “Point in time” means the issue date. Everything in scope has to be supported and compliant on the day the certificate is issued.
Organisations that opened an assessment account before 27 April were given six months to finish under the previous rules. That window has now closed, so every new assessment and every renewal is marked against version 3.3. If your current certificate was issued under the old rules, your next renewal will be your first under the new ones.
The 14-day rule in practice
The rule applies to any update that fixes a vulnerability the vendor calls “critical” or “high risk”, scores 7 or more on the standard CVSS scale, or comes with no severity details at all. In practice, treat every security update as if it counts. It covers all software on devices in scope: Windows and macOS, phones and tablets, browsers, PDF readers, plug-ins, and the firmware on your router and firewall.
The requirements also say software must be licensed and supported, automatic updates should be switched on where possible, and anything that’s no longer supported must be removed or isolated from the internet entirely. Windows usually looks after itself. The gaps are usually elsewhere:
- a router or firewall whose firmware hasn’t been touched since it was installed
- a laptop that sat switched off in a drawer for a month
- apps installed by staff outside your normal update process
- a home worker who never restarts, so downloaded updates never finish installing
What trips businesses up
These are the problems we most often find when we check a business before its assessment. Any one of them can mean a fail.
- One cloud app without MFA. Microsoft 365 is usually protected. The accounting package, the payroll portal, the CRM or the file-sharing service often isn’t. Under version 3.3, each one is checked, and a paid add-on for MFA still counts as “available”.
- Apps nobody knew about. Staff sign up to useful tools with their work email address, and under the new definition those tools are in scope. If you don’t know they exist, you can’t secure them or answer the questions accurately.
- Unsupported devices. An old Windows PC with no security updates, a phone that’s stopped getting updates, an ageing network storage box or an internet provider’s router that’s out of support. These have to be upgraded, replaced or taken out of scope properly.
- Admin accounts used for everyday work. Administrator access must be kept to separate accounts that aren’t used for email or browsing. The requirements also cover third-party accounts, including the ones your IT support provider uses.
- Old accounts left open. Leavers’ accounts and old shared logins that nobody removed. Accounts must be removed or disabled when they’re no longer needed.
- Home workers and personal phones. Any device that accesses your organisation’s data or services is in scope, including phones that get work email.
- Answering from policy, not reality. The questions ask what is actually configured on your devices, not what your policy says should happen. If you’re not sure, check before you answer.
Passkeys: optional, but worth it
You don’t need passkeys to pass Cyber Essentials, but they’re one of the strongest ways to meet the MFA requirement. In April 2026 the NCSC said passkeys should now be people’s first choice of login, and the new requirements recognise FIDO2 passkeys as MFA. Text message codes still count, but the scheme recommends a better option where one is available. Our guide to passkeys in Microsoft 365 explains how to roll them out.
How we prepare businesses for Cyber Essentials
- A gap check against version 3.3. We list every device and cloud service in scope, including the apps each team actually logs in to, and check MFA, updates, admin accounts and firmware against the current questions.
- Fixes before the assessment. We switch on MFA (including any add-on you need to buy), replace or remove unsupported software, separate admin accounts and close old ones.
- Help with the questions. We help you answer accurately and write a clear scope description, then a director signs it off and the certification body marks it.
Our Cyber Essentials service starts from £295 + VAT, plus the IASME assessment fee, and every business we’ve prepared has passed. We’re not a certification body: the certificate comes from an IASME-licensed certification body.
We also help businesses get Cyber Essentials Plus, where the certification body tests a sample of your devices hands-on. That’s worth preparing for properly: under the 2026 rules, if devices fail the initial sample, the assessor retests with a fresh random sample as well, and a second failure means your basic certificate is revoked. We get you ready for the audit and support you through it.
For businesses whose IT we already manage, most of this is in place all year: we keep every system we look after to the Cyber Essentials standard, certified or not. Read more about our Cyber Essentials service and how it fits with our wider IT security work, or book a call and we’ll tell you where you stand.
Sources
- NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026)
- NCSC, Cyber Essentials help and resources (effective date of v3.3 and use of v3.2 for earlier applications)
- IASME, Important update: changes to Cyber Essentials for April 2026
- NCSC, Leave passwords in the past: passkeys are the future (23 April 2026)